EUVD-2022-30127

Malicious code in bioql PyPI...

EUVD-2022-30218

Malicious code in bioql PyPI...

The vulnerability of the SetSysTimeCfg() function in Tenda AX3 Wi-Fi routers allows a hacker to execute arbitrary code or cause a service failure.

The vulnerability of the SetSysTimeCfg function in Tenda AX3 Wi-Fi routers’ microprogramming software lies in the copying of buffers without checking the size of the input data during the processing of the ntpServer parameter. Exploiting this vulnerability allows a remote attacker to execute...

Tenda AX3 fromSetSysTime function buffer overflow vulnerability

Tenda AX3 is a home dual-band Gigabit wireless router from Tenda Technology that supports Wi-Fi6 802.11ax standard and focuses on high-performance network coverage and stable connection. The Tenda AX3 suffers from a buffer overflow vulnerability, which stems from the ntpServer parameter in the...

CVE-2025-55603

Tenda AX3 V16.03.12.10CN is vulnerable to Buffer Overflow in the fromSetSysTime function via the ntpServer parameter...

CVE-2025-55603

The Tenda AX3 Wi-Fi router is vulnerable to a buffer overflow in the fromSetSysTime function (specifically the SetSysTimeCfg() function) within its microprogramming software. The root cause is the failure to validate the length and size of input data when processing the ntpServer parameter. A rem...

CVE-2025-55603

Tenda AX3 V16.03.12.10CN is vulnerable to Buffer Overflow in the fromSetSysTime function via the ntpServer parameter...

CVE-2025-7553

A vulnerability classified as critical has been found in D-Link DIR-818LW up to 20191215. This affects an unknown part of the component System Time Page. The manipulation of the argument NTP Server leads to os command injection. It is possible to initiate the attack remotely. The exploit has been...

PT-2025-29891 · Lilin · Lilin Digital Video Recorder

Name of the Vulnerable Software and Affected Versions: LILIN Digital Video Recorder DVR versions prior to 2.0b60 20200207 Description: A command injection issue exists due to insufficient sanitization of the FTP and NTP Server fields in the service configuration. An attacker with access to the...

CVE-2025-34129: Improper Neutralization of Special Elements used in an OS Command

A command injection vulnerability exists in LILIN Digital Video Recorder DVR devices prior to firmware version 2.0b6020200207 due to insufficient sanitization of the FTP and NTP Server fields in the service configuration. An attacker with access to the configuration interface can upload a malicio...

CVE-2025-7553

A vulnerability classified as critical has been found in D-Link DIR-818LW up to 20191215. This affects an unknown part of the component System Time Page. The manipulation of the argument NTP Server leads to os command injection. It is possible to initiate the attack remotely. The exploit has been...

D-Link DIR-818LW 安全漏洞

The D-Link DIR-818LW is a dual-band Gigabit cloud router that supports wireless standards such as IEEE 802.11ac and IEEE 802.11n, with a wireless transfer rate of up to 433Mbps, and also provides one USB 2.0 port and four Gigabit wired ports. The D-Link DIR-818LW suffers from a command injection...

PT-2025-29398 · D Link · Dir-818Lw

Name of the Vulnerable Software and Affected Versions: D-Link DIR-818LW versions up to 20191215 Description: A critical issue exists in D-Link DIR-818LW. The vulnerability is located within the System Time Page component. Manipulation of the NTP Server argument can lead to os command injection,...

CVE-2024-30572

Netgear R6850 1.1.0.88 was discovered to contain a command injection vulnerability via the ntpserver parameter...

CVE-2022-42160

D-Link COVR 1200,1202,1203 v1.08 was discovered to contain a command injection vulnerability via the systemtimetimezone parameter at function SetNTPServerSettings...

CVE-2022-28573

D-Link DIR-823-Pro v1.0.2 was discovered to contain a command injection vulnerability in the function SetNTPserverSeting. This vulnerability allows attackers to execute arbitrary commands via the systemtimetimezone parameter...

CVE-2020-9020

Iteris Vantage Velocity Field Unit 2.3.1, 2.4.2, and 3.0 devices allow the injection of OS commands into cgi-bin/timeconfig.py via shell metacharacters in the NTP Server field...

CVE-2020-35262

Cross Site Scripting XSS vulnerability in Digisol DG-HR3400 can be exploited via the NTP server name in Time and date module and "Keyword" in URL Filter...

CVE-2020-25498

Cross Site Scripting XSS vulnerability in Beetel router 777VR1 can be exploited via the NTP server name in System Time and "Keyword" in URL Filter...

Edimax IP Camera NTP_serverName command injection

Added: 03/21/2025 CVE: CVE-2025-1316 Background Edimax IP Cameras are a product line of security cameras which send video footage over an IP network. Problem A command injection vulnerability in the NTPserverName POST parameter of an update request allows remote attackers to execute arbitrary...